Skip to content
arrow_back
E8-MF-ML2.8
search account_circle
boltASD Essential Eight

Essential Eight MF-ML2.8Timely analysis of event logs from internet-facing servers

Official control statement

Event logs from internet-facing servers are analysed in a timely manner to detect cybersecurity events.
boltASD Essential EightE8-MF-ML2.8

Quoted as published. Everything else on this page is written by Control Stack.

In plain English

Regularly check logs from online servers to quickly spot security issues.

ML2Essential EightMulti-factor authentication
Control Stack classificationDetectiveSecurity monitoring
record_voice_over

What this means in practice

Regularly checking the logs from your internet-facing servers is akin to keeping an eye on your store's front door. If you don't review them frequently, you might miss signs of a cyber attack that could harm your business. By examining these logs promptly, you can catch potential security threats early before they cause severe damage.

Framework

ASD Essential Eight

Control effect (Control Stack)

Detective

E8 mitigation strategy

Multi-factor authentication

Classifications

N/A

Official last update

N/A

Control Stack last updated

29 Sept 2026

E8 maturity levels

ML2

priority_high

Why it matters

If internet-facing server logs aren't analysed promptly, intrusions and suspicious activity may go unnoticed, increasing the chance of data theft, malware spread or service disruption.

settings

Operational notes

Review internet-facing server logs daily (or near real-time) via SIEM; alert on suspicious auth, web errors and admin changes, and escalate confirmed incidents within defined timeframes.

build

Implementation tips

  • Security officer: Establish a schedule for when event logs should be analysed, ensuring it's a regular task.
  • IT team: Set up automated alerts for unusual activity in event logs from internet-facing servers to ensure prompt detection.
  • System administrator: Use a log management tool to collect and consolidate logs, making analysis more efficient.
  • IT manager: Allocate resources and time for staff to analyse event logs consistently as part of their routine duties.
fact_check

Audit / evidence tips

  • AskHow often are the logs from your internet-facing servers reviewed?
  • Look atExamine the calendar or schedule showing planned log review dates and times
  • GoodLogs are reviewed daily or weekly, with a set schedule visible
  • AskWhat happens if an unusual event is detected in the logs?
  • Look atCheck for documentation of response procedures or previous incidents
  • GoodThere is a clear, documented process to investigate abnormal log entries, with past examples of successful resolution
link

Cross-framework mappings

How E8-MF-ML2.8 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.

ISO 27001

ControlNotesDetails
layersPartially meets(2)expand_less
Annex A 8.15E8-MF-ML2.8 requires timely analysis of event logs specifically from internet-facing servers to detect cyber security events
Annex A 8.16E8-MF-ML2.8 focuses on timely analysis of event logs from internet-facing servers to detect cyber security events

ASD ISM

ControlNotesDetails
equalEquivalent(1)expand_less
ISM-1906E8-MF-ML2.8 requires event logs from internet-facing servers to be analysed in a timely manner to detect cyber security events
open_in_fullBroader than(1)expand_less
ISM-1228E8-MF-ML2.8 requires timely analysis of event logs from internet-facing servers to detect cyber security events
layersPartially meets(1)expand_less
ISM-1987ISM-1987 requires event logs from security products to be analysed in a timely manner to detect cyber security events
sync_altPartially overlaps(5)expand_less
ISM-0634E8-MF-ML2.8 requires timely analysis of event logs from internet-facing servers to detect cyber security events
ISM-1030E8-MF-ML2.8 requires timely analysis of event logs from internet-facing servers to detect cyber security events
ISM-1907ISM-1907 requires timely analysis of logs from non-internet-facing servers to detect cyber security events
ISM-1961E8-MF-ML2.8 requires organisations to analyse event logs from internet-facing servers in a timely manner to detect cyber security events
ISM-1986ISM-1986 requires event logs from critical servers to be analysed in a timely manner to detect cyber security events
handshakeSupports(1)expand_less
ISM-0580ISM-0580 requires an organisation to develop, implement and maintain an event logging policy to ensure events are recorded and monitored
extensionDepends on(3)expand_less
ISM-0988E8-MF-ML2.8 requires organisations to analyse event logs from internet-facing servers in a timely manner to detect cyber security events
ISM-1405E8-MF-ML2.8 requires timely analysis of event logs from internet-facing servers to detect cyber security events
ISM-1978E8-MF-ML2.8 requires timely analysis of event logs from internet-facing servers to detect cyber security events

These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.

Related Essential 8 controls in Multi-factor authentication

E8-MF-ML2.5
Multi-factor authentication used for system access is phishing-resistant
E8-MF-ML2.6
MFA success and failure events are centrally logged
E8-MF-ML2.7
Protect event logs from unauthorised changes
E8-MF-ML2.9
Cyber security events are analysed to identify incidents timely
E8-MF-ML2.10
Report cyber security incidents to the Chief Information Security Officer promptly
E8-MF-ML2.11
Report cyber security incidents to ASD immediately

See all Multi-factor authentication controls, or browse the full ASD Essential Eight library.

Mapping detail

Mapping

Direction

Controls